Healthcare Data Breach Lookup
Got a letter saying your health data was exposed? Search the 8,092 breach reports that hospitals, insurers and their vendors have filed with the US health department since 2009.
Each result shows how many people were affected and what kind of breach it was. Most archived cases also carry the government’s own account of what happened. The search runs in your browser, so the name you type never reaches us.
The search needs JavaScript. Without it, here are the largest recent breaches; the full list is on the HHS breach portal.
How to read a result
- Name. Shown the way the organization filed it with the Department of Health and Human Services (HHS). A hospital can appear under its parent company, and a breach at a vendor under the vendor’s name.
- Reported. The day HHS received the report. The breach itself happened earlier: the HIPAA Breach Notification Rule gives organizations up to 60 days from the day they discover one.
- People affected. The number the organization reported to HHS.
- HHS list. “Under investigation” means the report is less than 24 months old and HHS’s Office for Civil Rights is still looking into it. It says nothing about who was at fault. The archive holds resolved cases and older reports, most of them with a short description by HHS.
- Vendor involved. “Yes” means a business associate played a part. That’s HIPAA’s term for a company that handles patient data on behalf of a provider or health plan.
If your provider is on the list
Start with the letter. Under HIPAA it has to tell you which kinds of information were involved, and that decides what’s worth doing.
- Social Security number. Freeze your credit at Equifax, Experian and TransUnion. It’s free, you have to contact all three, and nobody can open a new credit account in your name while the freeze is on. If the letter offers free credit monitoring, take it.
- Insurance or medical details. Read every Explanation of Benefits statement and medical bill that arrives. A visit you didn’t make or a prescription you don’t take is the warning sign of medical identity theft. Ask your provider for a copy of your records and report mistakes in writing; they have 30 days to answer.
- Bank account or card number. Call your bank or card issuer and have the account or card replaced.
- Password. Change it, and change it anywhere else you used the same one.
If someone has already used your details, IdentityTheft.gov, run by the Federal Trade Commission (FTC), builds a recovery plan with you step by step.
If you can’t find it
No result doesn’t mean no breach. These are the usual reasons.
- The name is different. Try one distinctive word instead of the full name, then the parent health system, then any other company the letter names.
- A vendor filed it. When the breach happened at a company working for your provider, the report can sit under that company’s name. 2,423 of the 8,092 reports involve a business associate.
- Fewer than 500 people. HHS only publishes breaches that affect 500 people or more. Smaller ones are reported to it once a year and stay off the list.
- It’s too new. Organizations have up to 60 days to report. On November 12, 2026, the newest report on HHS’s list was dated October 16, 2026.
- HIPAA doesn’t cover the company. The list holds providers, health plans, clearinghouses and their vendors. Health apps outside HIPAA answer to the FTC’s Health Breach Notification Rule instead, and those reports aren’t here.
Is the letter real?
A HIPAA breach notice comes by first-class mail, or by email only if you agreed to get notices that way. It describes what happened, lists the kinds of information involved, says what the organization is doing about it and what you can do, and gives contact details.
A match in the search tells you the breach is real. It can’t tell you the letter is. When in doubt, call the organization on a number from an old bill or your insurance card, not the one in the letter.
Where the data comes from
Every entry comes from the breach portal of the HHS Office for Civil Rights, which by law lists breaches of unsecured health information affecting 500 or more people. HHS keeps two lists, the cases under investigation (732) and the archive (7,360). We download both and put them in one search. The last download was on November 12, 2026, and we repeat it every week.
Names, numbers and descriptions are HHS’s and the reporting organizations’, typos and duplicate entries included. We only tidy the spacing. The earliest report is dated October 21, 2009.
The search runs on your device. Your browser downloads the list once, and what you type is never sent to us or put in the page address. Opening a result fetches a file with the descriptions of about 400 reports, so the request doesn’t show which one you opened.
Download all 8,092 reports as a CSV file (5.6 MB). For the trends in these reports, see our healthcare data breach statistics for 2026.
Sources: HHS Office for Civil Rights, breach portal and Breach Notification Rule; Federal Trade Commission, guidance on credit freezes, medical identity theft, data breaches and the Health Breach Notification Rule. Checked November 12, 2026.